[PATCH net] net/packet: charge fanout groups to the memory cgroup

[PATCH net] net/packet: charge fanout groups to the memory cgroup

[Ahmad AG]

fanout_add() allocates a new group with room for max_num_members
socket pointers. Since commit 9c661b0b8544 ("net/packet: make
packet_fanout.arr size configurable up to 64K") that is up to 64K
pointers, 512 KB per group, from a single PACKET_FANOUT setsockopt().
The allocation uses GFP_KERNEL, so it is not charged to the caller's
memory cgroup.

Each packet socket can create its own group, so a process with
CAP_NET_RAW in its own user and network namespace holds about 512 KB
of kernel memory per open socket that its memory cgroup never sees.
In a cgroup with memory.max set to 16M, 256 sockets each creating a
group with max_num_members = 65536 took 264 MB of system memory while
memory.current grew by 380 KB.

Allocate the group with GFP_KERNEL_ACCOUNT, as other allocations a
user can make on demand in the networking stack already do. With the
change the same test in the 16M cgroup is stopped by the cgroup's OOM
killer, and with memory.max at 512M the 256 groups charge 262656 KB
for 264640 KB of system memory used.

The missing charge was found by code inspection of net/packet/ with
the help of an LLM and then triggered with a small test program that
creates the sockets and groups and reads memory.current; the numbers
above are from that run. Tested in a QEMU/KVM guest on this tree
(x86_64_defconfig plus kvm_guest.config, KASAN, MEMCG, PACKET),
running the test as uid 1000 in a cgroup v2 memory cgroup.
tools/testing/selftests/net/psock_fanout passes before and after.

Fixes: 9c661b0b8544 ("net/packet: make packet_fanout.arr size
configurable up to 64K")
Cc: stable@vger.kernel.org
Assisted-by: Claude Code
Signed-off-by: Ahmad AG <ahmadag1001@gmail.com>
---
 net/packet/af_packet.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 823e0911c91..406397acc5c 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1778,7 +1778,8 @@ static int fanout_add(struct sock *sk, struct
fanout_args *args)
  /* legacy PACKET_FANOUT_MAX */
  args->max_num_members = 256;
  err = -ENOMEM;
- match = kvzalloc_flex(*match, arr, args->max_num_members);
+ match = kvzalloc_flex(*match, arr, args->max_num_members,
+      GFP_KERNEL_ACCOUNT);
  if (!match)
  goto out;
  write_pnet(&match->net, sock_net(sk));

base-commit: c339f4010dea8b0d754f84ace70cd1b089878ef8
-- 
2.43.0

Re: [PATCH net] net/packet: charge fanout groups to the memory cgroup

[Willem de Bruijn]

Ahmad AG wrote:
> fanout_add() allocates a new group with room for max_num_members
> socket pointers. Since commit 9c661b0b8544 ("net/packet: make
> packet_fanout.arr size configurable up to 64K") that is up to 64K
> pointers, 512 KB per group, from a single PACKET_FANOUT setsockopt().
> The allocation uses GFP_KERNEL, so it is not charged to the caller's
> memory cgroup.
>
> Each packet socket can create its own group, so a process with
> CAP_NET_RAW in its own user and network namespace holds about 512 KB
> of kernel memory per open socket that its memory cgroup never sees.
> In a cgroup with memory.max set to 16M, 256 sockets each creating a
> group with max_num_members = 65536 took 264 MB of system memory while
> memory.current grew by 380 KB.
> 
> Allocate the group with GFP_KERNEL_ACCOUNT, as other allocations a

This is not the only such allocation in packet sockets that does not
account. If addressing that, probably scan all such allocations and
update them in one go.

> user can make on demand in the networking stack already do. With the
> change the same test in the 16M cgroup is stopped by the cgroup's OOM
> killer, and with memory.max at 512M the 256 groups charge 262656 KB
> for 264640 KB of system memory used.
> 
> The missing charge was found by code inspection of net/packet/ with
> the help of an LLM and then triggered with a small test program that
> creates the sockets and groups and reads memory.current; the numbers
> above are from that run. Tested in a QEMU/KVM guest on this tree
> (x86_64_defconfig plus kvm_guest.config, KASAN, MEMCG, PACKET),
> running the test as uid 1000 in a cgroup v2 memory cgroup.
> tools/testing/selftests/net/psock_fanout passes before and after.
> 
> Fixes: 9c661b0b8544 ("net/packet: make packet_fanout.arr size
> configurable up to 64K")

Your email client corrupted the patch.

> Cc: stable@vger.kernel.org
> Assisted-by: Claude Code
> Signed-off-by: Ahmad AG <ahmadag1001@gmail.com>
> ---
>  net/packet/af_packet.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> index 823e0911c91..406397acc5c 100644
> --- a/net/packet/af_packet.c
> +++ b/net/packet/af_packet.c
> @@ -1778,7 +1778,8 @@ static int fanout_add(struct sock *sk, struct
> fanout_args *args)
>   /* legacy PACKET_FANOUT_MAX */
>   args->max_num_members = 256;
>   err = -ENOMEM;
> - match = kvzalloc_flex(*match, arr, args->max_num_members);
> + match = kvzalloc_flex(*match, arr, args->max_num_members,
> +      GFP_KERNEL_ACCOUNT);
>   if (!match)
>   goto out;
>   write_pnet(&match->net, sock_net(sk));
> 
> base-commit: c339f4010dea8b0d754f84ace70cd1b089878ef8
> -- 
> 2.43.0

Re: [PATCH net] net/packet: charge fanout groups to the memory cgroup

[Ahmad AG]

Thanks. I will scan all allocations in net/packet/ and send a v2
covering them in one patch, using a mail setup that keeps the patch
intact.

On Thu, Oct 29, 2026 at 7:10 PM Willem de Bruijn
<willemdebruijn.kernel@gmail.com> wrote:
>
> Ahmad AG wrote:
> > fanout_add() allocates a new group with room for max_num_members
> > socket pointers. Since commit 9c661b0b8544 ("net/packet: make
> > packet_fanout.arr size configurable up to 64K") that is up to 64K
> > pointers, 512 KB per group, from a single PACKET_FANOUT setsockopt().
> > The allocation uses GFP_KERNEL, so it is not charged to the caller's
> > memory cgroup.
> >
> > Each packet socket can create its own group, so a process with
> > CAP_NET_RAW in its own user and network namespace holds about 512 KB
> > of kernel memory per open socket that its memory cgroup never sees.
> > In a cgroup with memory.max set to 16M, 256 sockets each creating a
> > group with max_num_members = 65536 took 264 MB of system memory while
> > memory.current grew by 380 KB.
> >
> > Allocate the group with GFP_KERNEL_ACCOUNT, as other allocations a
>
> This is not the only such allocation in packet sockets that does not
> account. If addressing that, probably scan all such allocations and
> update them in one go.
>
> > user can make on demand in the networking stack already do. With the
> > change the same test in the 16M cgroup is stopped by the cgroup's OOM
> > killer, and with memory.max at 512M the 256 groups charge 262656 KB
> > for 264640 KB of system memory used.
> >
> > The missing charge was found by code inspection of net/packet/ with
> > the help of an LLM and then triggered with a small test program that
> > creates the sockets and groups and reads memory.current; the numbers
> > above are from that run. Tested in a QEMU/KVM guest on this tree
> > (x86_64_defconfig plus kvm_guest.config, KASAN, MEMCG, PACKET),
> > running the test as uid 1000 in a cgroup v2 memory cgroup.
> > tools/testing/selftests/net/psock_fanout passes before and after.
> >
> > Fixes: 9c661b0b8544 ("net/packet: make packet_fanout.arr size
> > configurable up to 64K")
>
> Your email client corrupted the patch.
>
> > Cc: stable@vger.kernel.org
> > Assisted-by: Claude Code
> > Signed-off-by: Ahmad AG <ahmadag1001@gmail.com>
> > ---
> >  net/packet/af_packet.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> > index 823e0911c91..406397acc5c 100644
> > --- a/net/packet/af_packet.c
> > +++ b/net/packet/af_packet.c
> > @@ -1778,7 +1778,8 @@ static int fanout_add(struct sock *sk, struct
> > fanout_args *args)
> >   /* legacy PACKET_FANOUT_MAX */
> >   args->max_num_members = 256;
> >   err = -ENOMEM;
> > - match = kvzalloc_flex(*match, arr, args->max_num_members);
> > + match = kvzalloc_flex(*match, arr, args->max_num_members,
> > +      GFP_KERNEL_ACCOUNT);
> >   if (!match)
> >   goto out;
> >   write_pnet(&match->net, sock_net(sk));
> >
> > base-commit: c339f4010dea8b0d754f84ace70cd1b089878ef8
> > --
> > 2.43.0
>
>